Performing a security action regarding an access request using a cluster-based determination of malicious intent

A method implemented by a computing system, the method comprising:

• clustering subsets of access requests into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types, the access requests requesting access to cloud resources;
• receiving an identified access request from an access requestor of a first requestor type, the identified access request using an identified access token to request performance of a designated access action;
• identifying access behaviors that are associated with the access requests in the respective clusters and that correspond to the identified access token, the access behaviors including a first access behavior indicating first predicted likelihoods of respective actions to be performed with regard to a first arbitrary access request that corresponds to the first requestor type and that uses the identified access token, the access behaviors further including a second access behavior indicating second predicted likelihoods of the respective actions to be performed with regard to a second arbitrary access request that corresponds to the second requestor type and that uses the identified access token;
• determining that the identified access request is a malicious access request based at least on the first access behavior indicating a relatively low predicted likelihood of the designated access action to be performed with regard to the first arbitrary access request that corresponds to the first requestor type and further based at least on the second access behavior indicating a relatively high predicted likelihood of the designated access action to be performed with regard to the second arbitrary access request that corresponds to the second requestor type;
• and
• as a result of determining that the identified access request is the malicious access request, performing a security action with regard to the identified access request.

A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:

• clustering subsets of access requests into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types, the access requests requesting access to cloud resources;
• receiving an identified access request from an access requestor of a first requestor type, the identified access request using an identified access token to request performance of a designated access action;
• identifying access behaviors that are associated with the access requests in the respective clusters and that correspond to the identified access token, the access behaviors including a first access behavior indicating first predicted likelihoods of respective actions to be performed with regard to a first arbitrary access request that corresponds to the first requestor type and that uses the identified access token, the access behaviors further including a second access behavior indicating second predicted likelihoods of the respective actions to be performed with regard to a second arbitrary access request that corresponds to the second requestor type and that uses the identified access token;
• determining that the identified access request is a malicious access request based at least on the first access behavior indicating a relatively low predicted likelihood of the designated access action to be performed with regard to the first arbitrary access request that corresponds to the first requestor type and further based at least on the second access behavior indicating a relatively high predicted likelihood of the designated access action to be performed with regard to the second arbitrary access request that corresponds to the second requestor type;
• and
• as a result of determining that the identified access request is the malicious access request, performing a security action with regard to the identified access request.